@noy-db/hub 0.3.0-pre.9 → 0.4.0-pre.0

package/dist/chunk-RFI7GGFO.js

@@ -0,0 +1,230 @@
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-VCTXU4AT.js";
+
+// src/with-party/team/managed-passphrase.ts
+var MemorySealingKeyProvider = class {
+  id;
+  fingerprint;
+  keyBytes;
+  constructor(opts) {
+    this.id = opts.id;
+    const encoded = new TextEncoder().encode(opts.id);
+    let h = 0;
+    for (let i = 0; i < encoded.length; i++) {
+      h = h * 31 + encoded[i] >>> 0;
+    }
+    this.fingerprint = new Uint8Array([
+      h >>> 24 & 255,
+      h >>> 16 & 255,
+      h >>> 8 & 255,
+      h & 255
+    ]);
+    this.keyBytes = new Uint8Array(16);
+    for (let i = 0; i < 16; i++) {
+      this.keyBytes[i] = this.fingerprint[i % 4] ^ i * 17;
+    }
+  }
+  async seal(passphrase) {
+    const out = new Uint8Array(4 + passphrase.length);
+    out.set(this.fingerprint, 0);
+    for (let i = 0; i < passphrase.length; i++) {
+      out[4 + i] = passphrase[i] ^ this.keyBytes[i % 16];
+    }
+    return out;
+  }
+  async unseal(sealed) {
+    if (sealed.length < 4) {
+      throw new Error("MemorySealingKeyProvider: sealed input too short");
+    }
+    for (let i = 0; i < 4; i++) {
+      if (sealed[i] !== this.fingerprint[i]) {
+        throw new Error(
+          `MemorySealingKeyProvider("${this.id}"): provider-id mismatch on unseal (sealed bytes were produced by a different provider)`
+        );
+      }
+    }
+    const body = sealed.subarray(4);
+    const out = new Uint8Array(body.length);
+    for (let i = 0; i < body.length; i++) {
+      out[i] = body[i] ^ this.keyBytes[i % 16];
+    }
+    return out;
+  }
+};
+async function sealRsaOaepTlv(plaintext, publicKeyPem) {
+  const b64 = publicKeyPem.replace(/-----BEGIN PUBLIC KEY-----/, "").replace(/-----END PUBLIC KEY-----/, "").replace(/\s+/g, "");
+  const spki = base64ToBytes(b64);
+  const recipientPub = await crypto.subtle.importKey(
+    "spki",
+    spki,
+    { name: "RSA-OAEP", hash: "SHA-256" },
+    false,
+    ["encrypt"]
+  );
+  const cekBytes = crypto.getRandomValues(new Uint8Array(32));
+  const cek = await crypto.subtle.importKey("raw", cekBytes, "AES-GCM", false, ["encrypt"]);
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, cek, plaintext));
+  const wrapped = new Uint8Array(await crypto.subtle.encrypt({ name: "RSA-OAEP" }, recipientPub, cekBytes));
+  cekBytes.fill(0);
+  if (wrapped.length !== 256) {
+    throw new Error(`sealRsaOaepTlv: expected 256-byte RSA-OAEP wrap, got ${wrapped.length}`);
+  }
+  const out = new Uint8Array(1 + 256 + 12 + ct.length);
+  out[0] = 1;
+  out.set(wrapped, 1);
+  out.set(iv, 1 + 256);
+  out.set(ct, 1 + 256 + 12);
+  return out;
+}
+function parseRsaOaepTlv(bytes) {
+  if (bytes.length < 1 + 256 + 12 + 16) {
+    throw new Error("parseRsaOaepTlv: sealed input too short");
+  }
+  if (bytes[0] !== 1) {
+    throw new Error(`parseRsaOaepTlv: unknown TLV version ${bytes[0]}`);
+  }
+  return {
+    wrapped: bytes.subarray(1, 1 + 256),
+    iv: bytes.subarray(1 + 256, 1 + 256 + 12),
+    ct: bytes.subarray(1 + 256 + 12)
+  };
+}
+async function aesGcmOpen(cekBytes, iv, ct) {
+  const cek = await crypto.subtle.importKey("raw", cekBytes, "AES-GCM", false, ["decrypt"]);
+  return new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv }, cek, ct));
+}
+var MemoryRecipientSealer = class {
+  id;
+  keypair;
+  constructor(opts) {
+    this.id = opts.id;
+    this.keypair = crypto.subtle.generateKey(
+      { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  }
+  async publishRecipientHint() {
+    const { publicKey } = await this.keypair;
+    const spki = await crypto.subtle.exportKey("spki", publicKey);
+    const pem = "-----BEGIN PUBLIC KEY-----\n" + bytesToBase64(new Uint8Array(spki)).match(/.{1,64}/g).join("\n") + "\n-----END PUBLIC KEY-----\n";
+    return { v: 1, pid: this.id, alg: "rsa-oaep-sha256", material: { publicKeyPem: pem } };
+  }
+  async sealForRecipient(plaintext, hint) {
+    if (hint.v !== 1) {
+      throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`);
+    }
+    if (hint.alg !== "rsa-oaep-sha256") {
+      throw new Error(`MemoryRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`);
+    }
+    const pem = hint.material["publicKeyPem"];
+    if (typeof pem !== "string") {
+      throw new Error("MemoryRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string");
+    }
+    return sealRsaOaepTlv(plaintext, pem);
+  }
+  async seal(plaintext) {
+    const hint = await this.publishRecipientHint();
+    return this.sealForRecipient(plaintext, hint);
+  }
+  async unseal(bytes) {
+    const { wrapped, iv, ct } = parseRsaOaepTlv(bytes);
+    const { privateKey } = await this.keypair;
+    const cekBytes = new Uint8Array(await crypto.subtle.decrypt({ name: "RSA-OAEP" }, privateKey, wrapped));
+    const pt = await aesGcmOpen(cekBytes, iv, ct);
+    cekBytes.fill(0);
+    return pt;
+  }
+};
+var SEALED_PASSPHRASE_RECORD_ID = "sealed-passphrase";
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+}
+function base64ToBytes(b64) {
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function parseSealedEnvelope(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const r = raw;
+  if (r._noydb_sealed !== 1) return void 0;
+  if (r.v === 1 && typeof r.pid === "string" && typeof r.payload === "string") {
+    return {
+      _noydb_sealed: 1,
+      providerId: r.pid,
+      sealed: base64ToBytes(r.payload)
+    };
+  }
+  if (typeof r.providerId === "string" && typeof r.sealed === "string") {
+    return {
+      _noydb_sealed: 1,
+      providerId: r.providerId,
+      sealed: base64ToBytes(r.sealed)
+    };
+  }
+  return void 0;
+}
+async function saveSealedPassphrase(store, vault, payload) {
+  const persisted = {
+    v: 1,
+    _noydb_sealed: 1,
+    pid: payload.providerId,
+    payload: bytesToBase64(payload.sealed)
+  };
+  const prior = await store.get(vault, "_meta", SEALED_PASSPHRASE_RECORD_ID);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: (prior?._v ?? 0) + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    // AES-GCM bypassed — the sealing layer is the security boundary.
+    _iv: "",
+    _data: JSON.stringify(persisted)
+  };
+  await store.put(vault, "_meta", SEALED_PASSPHRASE_RECORD_ID, env);
+}
+async function loadSealedPassphrase(store, vault) {
+  const envelope = await store.get(vault, "_meta", SEALED_PASSPHRASE_RECORD_ID);
+  if (!envelope) return void 0;
+  try {
+    return parseSealedEnvelope(JSON.parse(envelope._data));
+  } catch {
+    return void 0;
+  }
+}
+async function resolveManagedSecret(store, vault, provider) {
+  const existing = await loadSealedPassphrase(store, vault);
+  if (existing) {
+    if (existing.providerId !== provider.id) {
+      throw new Error(
+        `Managed-mode vault "${vault}" was sealed under provider id "${existing.providerId}" but the current SealingKeyProvider is "${provider.id}". Pass the same provider that originally enrolled the vault, or treat this as a fresh enrollment and clear \`_meta/sealed-passphrase\` first.`
+      );
+    }
+    const plaintext = await provider.unseal(existing.sealed);
+    return bytesToBase64(plaintext);
+  }
+  const random = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(random);
+  const sealed = await provider.seal(random);
+  await saveSealedPassphrase(store, vault, { providerId: provider.id, sealed });
+  return bytesToBase64(random);
+}
+
+export {
+  MemorySealingKeyProvider,
+  sealRsaOaepTlv,
+  parseRsaOaepTlv,
+  aesGcmOpen,
+  MemoryRecipientSealer,
+  SEALED_PASSPHRASE_RECORD_ID,
+  parseSealedEnvelope,
+  saveSealedPassphrase,
+  loadSealedPassphrase,
+  resolveManagedSecret
+};
+//# sourceMappingURL=chunk-RFI7GGFO.js.map

package/dist/chunk-RJ6K6K5M.js

@@ -0,0 +1,36 @@
+import {
+  LookupHandle
+} from "./chunk-MT62YSPZ.js";
+
+// src/via/lookup/active.ts
+function withLookup() {
+  return {
+    buildLookupHandle(opts) {
+      return new LookupHandle(
+        opts.adapter,
+        opts.compartmentName,
+        opts.dimensionName,
+        opts.keyring,
+        opts.reservedEnvelopes,
+        opts.encrypted,
+        opts.ledger,
+        opts.options,
+        opts.findAndUpdateReferences,
+        opts.emitter,
+        opts.buildDeleteMarker,
+        // #647 fix wave 1
+        opts.onDirty,
+        // #650 Task 4
+        opts.onRecordMutated,
+        // #650 Task 4
+        opts.checkReferencesOnDelete
+        // #650 Task 5
+      );
+    }
+  };
+}
+
+export {
+  withLookup
+};
+//# sourceMappingURL=chunk-RJ6K6K5M.js.map

package/dist/chunk-RJ6K6K5M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/lookup/active.ts"],"sourcesContent":["/**\n * Active lookup strategy — `withLookup()` returns the real implementation\n * that constructs `LookupHandle` instances (the `_dict_*` / future\n * `_lookup_*` reserved-collection engine).\n *\n * #650 Task 1 (via-lookup extraction, phase D): this is the new home for\n * the handle-construction logic that used to live inline in\n * `via/i18n/active.ts`'s `withI18n().buildDictionaryHandle`, which\n * now delegates here (same handle, new home — see that file). Splitting\n * the import chain through this file is the same `#553` tree-shake seam\n * `via/i18n/active.ts` already used: the `LookupHandle` engine only\n * ships in a consumer's bundle once something reaches `withLookup()` (today\n * that's transitively via `withI18n()`; later phase-D tasks may call it\n * directly).\n *\n * @public\n */\n\nimport type { LookupStrategy, BuildLookupHandleOptions } from '../../port/with/lookup-strategy.js'\nimport { LookupHandle } from './handle.js'\n\nexport function withLookup(): LookupStrategy {\n  return {\n    buildLookupHandle<Keys extends string = string>(\n      opts: BuildLookupHandleOptions<Keys>,\n    ): LookupHandle<Keys> {\n      return new LookupHandle<Keys>(\n        opts.adapter,\n        opts.compartmentName,\n        opts.dimensionName,\n        opts.keyring,\n        opts.reservedEnvelopes,\n        opts.encrypted,\n        opts.ledger,\n        opts.options,\n        opts.findAndUpdateReferences,\n        opts.emitter,\n        opts.buildDeleteMarker, // #647 fix wave 1\n        opts.onDirty, // #650 Task 4\n        opts.onRecordMutated, // #650 Task 4\n        opts.checkReferencesOnDelete, // #650 Task 5\n      )\n    },\n  }\n}\n"],"mappings":";;;;;AAqBO,SAAS,aAA6B;AAC3C,SAAO;AAAA,IACL,kBACE,MACoB;AACpB,aAAO,IAAI;AAAA,QACT,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA;AAAA,QACL,KAAK;AAAA;AAAA,QACL,KAAK;AAAA;AAAA,QACL,KAAK;AAAA;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-RNG4VRP4.js

@@ -0,0 +1,75 @@
+import {
+  generateULID
+} from "./chunk-ZJADGNYF.js";
+import {
+  openEnvelopeJson
+} from "./chunk-W4TCUGQR.js";
+import {
+  encrypt
+} from "./chunk-HOONYZY2.js";
+
+// src/with-audit/consent/consent.ts
+var CONSENT_AUDIT_COLLECTION = "_consent_audit";
+async function writeConsentEntry(adapter, vault, encrypted, entry, getDEK) {
+  const id = generateULID();
+  const full = {
+    id,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    ...entry
+  };
+  const envelope = await buildEnvelope(full, encrypted, getDEK);
+  await adapter.put(vault, CONSENT_AUDIT_COLLECTION, id, envelope);
+}
+async function loadConsentEntries(adapter, vault, encrypted, getDEK, filter = {}) {
+  const ids = await adapter.list(vault, CONSENT_AUDIT_COLLECTION);
+  const entries = [];
+  for (const id of ids.sort()) {
+    const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id);
+    if (!envelope) continue;
+    const entry = await decryptEntry(envelope, encrypted, getDEK);
+    if (!matchesFilter(entry, filter)) continue;
+    entries.push(entry);
+  }
+  return entries;
+}
+async function buildEnvelope(entry, encrypted, getDEK) {
+  const json = JSON.stringify(entry);
+  if (!encrypted) {
+    return {
+      _noydb: 1,
+      _v: 1,
+      _ts: entry.timestamp,
+      _iv: "",
+      _data: json
+    };
+  }
+  const dek = await getDEK(CONSENT_AUDIT_COLLECTION);
+  const { iv, data } = await encrypt(json, dek);
+  return {
+    _noydb: 1,
+    _v: 1,
+    _ts: entry.timestamp,
+    _iv: iv,
+    _data: data
+  };
+}
+async function decryptEntry(envelope, encrypted, getDEK) {
+  if (!encrypted) return JSON.parse(envelope._data);
+  const json = await openEnvelopeJson(envelope, await getDEK(CONSENT_AUDIT_COLLECTION));
+  return JSON.parse(json);
+}
+function matchesFilter(entry, f) {
+  if (f.since && entry.timestamp < f.since) return false;
+  if (f.until && entry.timestamp > f.until) return false;
+  if (f.collection && entry.collection !== f.collection) return false;
+  if (f.actor && entry.actor !== f.actor) return false;
+  if (f.purpose && entry.purpose !== f.purpose) return false;
+  return true;
+}
+
+export {
+  CONSENT_AUDIT_COLLECTION,
+  writeConsentEntry,
+  loadConsentEntries
+};
+//# sourceMappingURL=chunk-RNG4VRP4.js.map

package/dist/chunk-RTEK4C4I.js

@@ -0,0 +1,41 @@
+import {
+  NoydbError
+} from "./chunk-W2OG6JOL.js";
+
+// src/with-shape/links/names.ts
+var LINK_COLLECTION_PREFIX = "_links_";
+function linkCollectionName(name) {
+  return `${LINK_COLLECTION_PREFIX}${name}`;
+}
+function isLinkCollectionName(name) {
+  return name.startsWith(LINK_COLLECTION_PREFIX);
+}
+function linkRowKey(aId, bId) {
+  return `${encodeURIComponent(aId)}|${encodeURIComponent(bId)}`;
+}
+var LinkIntegrityError = class extends NoydbError {
+  link;
+  endpoint;
+  id;
+  count;
+  constructor(link, endpoint, id, count) {
+    super(
+      "LINK_INTEGRITY",
+      `Cannot delete "${endpoint}"/"${id}": ${count} link(s) in "${link}" still reference it (onDelete: 'strict').`
+    );
+    this.name = "LinkIntegrityError";
+    this.link = link;
+    this.endpoint = endpoint;
+    this.id = id;
+    this.count = count;
+  }
+};
+
+export {
+  LINK_COLLECTION_PREFIX,
+  linkCollectionName,
+  isLinkCollectionName,
+  linkRowKey,
+  LinkIntegrityError
+};
+//# sourceMappingURL=chunk-RTEK4C4I.js.map